5 ms·

In the future, if folks find vulnerabilities in GitHub, please report them via an Email to security@github.com or support@github.com.

rdtsc 15y ago
Or if you want to keep your account, don't tell GitHub, but sell the vulnerability on black market and make some profit off of it.
- holman 15y ago
  We will never, ever suspend or ban accounts that follow responsible disclosure. Ever.
  - mpd 15y ago
    Please update your TOS to explicitly define what 'reasonable disclosure' is. I'm a paying customer and this comes off as arbitrary.
  - deleted 15y ago
    [deleted]
  - andybak 15y ago
    Can you not see that to many people, suspending Egor's account looks churlish and petty. It's bad PR with your core demographic.
  - mtkd 15y ago
    If the only activity he's done is what he's mentioned in those issue comments - he really needs his account reinstating soon. There was no malicious intent from those comments - and he's done you a favour. If his account doesn't get reinstated - Github has become something I didn't think it would whilst the founders were still in the business.
  - rdtsc 15y ago
    I think from a PR point of view with respect to the rest of the developer community you might have lost this one. You didn't eliminate the threat posed by him as an individual because he can create a new account. (Note: as far as your enterprise or big-corp clients, you probably did the right thing, because that is what they would have done and that is what they expected. So if they are the clients who put bread on your table, then you have acted correctly) What I think you could have done better (and I speak as a developer not a corporate client): issue a public note saying something to the effect of "Thanks for finding this out, maybe you'd like to interview with us. But please, everyone, do not do it this way, this is against TOS and most likely illegal. Here is is the email where to report these things and we will make sure to give you full credit after we fix the problem".
    - JumpCrisscross 15y ago
      A lot of the fire could have been cooled with the suspension notice being accompanied with (ideally preceded by) a personal note to Egor. The absence of that is what makes this seem more like a GoDaddy firing-from-the-hip move than a rationally thought out one.
  - sneak 15y ago
    He didn't delete or break anything, yet got the issue raised and fixed near-instantly. That strikes me as responsible. Stop parroting buzzwords - nobody likes a pedant.
  - vidarh 15y ago
    As someone who uses Github quite a bit: Closing his account was a shitty move.
  - mcantelon 15y ago
    The hacker reported the vulnerbility responsibly but was ignored. Now you've suspended his account even though he did no harm. It looks from the outside like you suspended his account because he embarrassed you and doesn't have the public clout of someone like Zed Shaw, who also demonstrated a vulnerability (and, unlike this case, caused some downtime) yet faced no similar reprisal.
  - sriramk 15y ago
    The parent shouldn't be getting downvoted. Let's not downvote important comments in the conversation just because we disagree with them.
- stock_toaster 15y ago
  This is bad advice. Did github run over your dog or something?
toyg 15y ago
To be honest, rather than taking it out on a 18-year-old messing around for bragging rights, you really should have ripped a new one into the Rails people. They knew of this problem (two bug reports were filed and closed) and completely dropped the ball. Now, this kid was noisy but harmless, and it did report the bug; someone else might have found the same hole (or read the same bugs) and exploited it silently for weeks. This was really the worst option: you've taught a kid to keep his mouth shut next time he finds a hole. It will be much safer for him to sell it on the black market for a quick buck.
- rsynnott 15y ago
  It's poor design in Rails, but not a security hole as such. The security hole was on GitHub's side.
  - toyg 15y ago
    I'm no Rails expert, but I tend to like the OpenBSD philosophy: if you ship with default options that are known to be insecure, you have a security bug. I know security is always a trade-off, but when your largest and most famous testimonials, with all their mad skillz and street cred, still manage to get it so spectacularly wrong, it's clear that the core engine is as guilty as any other component.
    - marshray 15y ago
      I like the part where the Rails developer says: The user has a flag to secure by default, I personally think that is enough. https://github.com/rails/rails/issues/5228#issuecomment-4300062 https://github.com/rails/rails/issues/5228#issuecomment-4300... In other words, Rails actually does have a flag to make the mass assignment feature secure by default. But this flag defaults to 'false'. https://github.com/rails/rails/pull/4062/files#diff-1 https://github.com/rails/rails/pull/4062/files#diff-1
  - jasonlotito 15y ago
    That's what PHP programmers were saying for years regarding magic_quotes (which didn't actually make things less secure). That this is apparently the default behaviour of Rails... yeah, it's a security issue.
phaker 15y ago
Are you planning to unban him later? I see why you'd want to suspend his account while you are fixing the hole. And I can see that it sucks that you got caught in the crossfire. And that reporting the bug quietly instead of announcing it to the whole world would cause much less headache. OTOH after reading the rails bug report I think that homakov's only option was to make a high profile demonstration and basically shame the Rails devs into fixing it. I realize that it's incredibly shitty for you, but I'm afraid they'd just write it off if he kept it quiet.

rdtsc 15y ago

Or if you want to keep your account, don't tell GitHub, but sell the vulnerability on black market and make some profit off of it.

holman 15y ago
We will never, ever suspend or ban accounts that follow responsible disclosure. Ever.
- mpd 15y ago
  Please update your TOS to explicitly define what 'reasonable disclosure' is. I'm a paying customer and this comes off as arbitrary.
- deleted 15y ago
  [deleted]
- andybak 15y ago
  Can you not see that to many people, suspending Egor's account looks churlish and petty. It's bad PR with your core demographic.
- mtkd 15y ago
  If the only activity he's done is what he's mentioned in those issue comments - he really needs his account reinstating soon. There was no malicious intent from those comments - and he's done you a favour. If his account doesn't get reinstated - Github has become something I didn't think it would whilst the founders were still in the business.
- rdtsc 15y ago
  I think from a PR point of view with respect to the rest of the developer community you might have lost this one. You didn't eliminate the threat posed by him as an individual because he can create a new account. (Note: as far as your enterprise or big-corp clients, you probably did the right thing, because that is what they would have done and that is what they expected. So if they are the clients who put bread on your table, then you have acted correctly) What I think you could have done better (and I speak as a developer not a corporate client): issue a public note saying something to the effect of "Thanks for finding this out, maybe you'd like to interview with us. But please, everyone, do not do it this way, this is against TOS and most likely illegal. Here is is the email where to report these things and we will make sure to give you full credit after we fix the problem".
  - JumpCrisscross 15y ago
    A lot of the fire could have been cooled with the suspension notice being accompanied with (ideally preceded by) a personal note to Egor. The absence of that is what makes this seem more like a GoDaddy firing-from-the-hip move than a rationally thought out one.
- sneak 15y ago
  He didn't delete or break anything, yet got the issue raised and fixed near-instantly. That strikes me as responsible. Stop parroting buzzwords - nobody likes a pedant.
- vidarh 15y ago
  As someone who uses Github quite a bit: Closing his account was a shitty move.
- mcantelon 15y ago
  The hacker reported the vulnerbility responsibly but was ignored. Now you've suspended his account even though he did no harm. It looks from the outside like you suspended his account because he embarrassed you and doesn't have the public clout of someone like Zed Shaw, who also demonstrated a vulnerability (and, unlike this case, caused some downtime) yet faced no similar reprisal.
- sriramk 15y ago
  The parent shouldn't be getting downvoted. Let's not downvote important comments in the conversation just because we disagree with them.
stock_toaster 15y ago
This is bad advice. Did github run over your dog or something?

toyg 15y ago

To be honest, rather than taking it out on a 18-year-old messing around for bragging rights, you really should have ripped a new one into the Rails people. They knew of this problem (two bug reports were filed and closed) and completely dropped the ball. Now, this kid was noisy but harmless, and it did report the bug; someone else might have found the same hole (or read the same bugs) and exploited it silently for weeks. This was really the worst option: you've taught a kid to keep his mouth shut next time he finds a hole. It will be much safer for him to sell it on the black market for a quick buck.

rsynnott 15y ago
It's poor design in Rails, but not a security hole as such. The security hole was on GitHub's side.
- toyg 15y ago
  I'm no Rails expert, but I tend to like the OpenBSD philosophy: if you ship with default options that are known to be insecure, you have a security bug. I know security is always a trade-off, but when your largest and most famous testimonials, with all their mad skillz and street cred, still manage to get it so spectacularly wrong, it's clear that the core engine is as guilty as any other component.
  - marshray 15y ago
    I like the part where the Rails developer says: The user has a flag to secure by default, I personally think that is enough. https://github.com/rails/rails/issues/5228#issuecomment-4300062 https://github.com/rails/rails/issues/5228#issuecomment-4300... In other words, Rails actually does have a flag to make the mass assignment feature secure by default. But this flag defaults to 'false'. https://github.com/rails/rails/pull/4062/files#diff-1 https://github.com/rails/rails/pull/4062/files#diff-1
- jasonlotito 15y ago
  That's what PHP programmers were saying for years regarding magic_quotes (which didn't actually make things less secure). That this is apparently the default behaviour of Rails... yeah, it's a security issue.

phaker 15y ago

Are you planning to unban him later? I see why you'd want to suspend his account while you are fixing the hole. And I can see that it sucks that you got caught in the crossfire. And that reporting the bug quietly instead of announcing it to the whole world would cause much less headache. OTOH after reading the rails bug report I think that homakov's only option was to make a high profile demonstration and basically shame the Rails devs into fixing it. I realize that it's incredibly shitty for you, but I'm afraid they'd just write it off if he kept it quiet.